CERT-UA has disclosed a significant shift in the tactics of threat cluster UAC-0099, revealing a novel infection chain that abuses a legitimate Notepad++ 8.8.3 executable to sideload malware, alongside an upgraded MATCHBOIL.V2 loader and two new tools named LUNCHPOKE and BURNYBEAR.
The campaign, documented since mid-summer 2026, marks a notable evolution from the group’s earlier MATCHBOIL and MATCHWOK toolset that CERT-UA previously linked to phishing operations against Ukraine’s defense sector.
The attack starts with a phishing email containing an embedded image that, when clicked, redirects victims through a shortened URL to a file-hosting service delivering a ZIP archive such as “Additions to the Order.zip”.
Hackers Weaponize Notepad++
Inside is a VBS script using a double extension trick padding filenames with excessive spaces before the final “.vbs” so a file appears to end in “.pdf” a classic social-engineering technique also seen in earlier UAC-0099 campaigns using double archives.
Once executed, the script drops a decoy PDF and a second archive, “Evernote.zip,” which contains a complete, legitimate Notepad++ 8.8.3 installation bundled with a rogue plugin.
The VBS script extracts “Evernote.zip” into a randomized directory under %PUBLIC%\Libs_ and launches the genuine “notepad++.exe,” which automatically loads a malicious DLL disguised as “NppExport.dll” from the plugins folder.
This works because Notepad++’s plugin-loading mechanism treats any DLL placed in its plugins directory as legitimate; its developers maintain this is intentional architecture rather than a vulnerability, fueling ongoing debate around CVE-2025-56383, which CERT-UA references only for search convenience without formally attributing the technique to it.
This is distinct from the earlier Notepad++ supply-chain compromise involving hijacked update infrastructure (WinGUp), which required no local plugin abuse.
“NppExport.dll,” tracked as LUNCHPOKE, extracts a password-protected archive (“updater.rar”) containing “RemoteLibUpdater.exe” and “InitTest.dll,” then copies the legitimate “schtasks.exe” binary to disguise a scheduled task launcher.
It creates a scheduled task that runs every three minutes to maintain persistence. “RemoteLibUpdater.exe,” identified as BURNYBEAR, is responsible for loading the final payload; if launched without proper arguments, it instead triggers resource-exhaustion behavior that consumes CPU and memory, likely as an anti-analysis or decoy mechanism.
“InitTest.dll” is the updated MATCHBOIL.V2 variant, retaining core functionality from the original C#-based MATCHBOIL loader scheduled task creation, C2 configuration updates, and payload downloading while adding WinRAR-based extraction and the ability to fetch WinRAR from Dropbox if absent on the host.
The original MATCHBOIL was designed to succeed the older LONEPAGE malware used by UAC-0099 and relied on HTTP headers containing hardware-derived identifiers for C2 communication.
| Component | Role | Notable Trait |
|---|---|---|
| LUNCHPOKE | Malicious DLL loader | Masquerades as Notepad++ plugin |
| BURNYBEAR | Secondary loader | Resource-exhaustion fallback if misused |
| MATCHBOIL.V2 | Final-stage loader | WinRAR-based payload extraction, Dropbox fallback |
CERT-UA urges administrators to keep common software updated, noting current versions as of July 21, 2026: WinRAR 7.23, 7-Zip 26.02, and Notepad++ 8.9.7, three major versions ahead of the abused 8.8.3 build.
Given Notepad++’s history of being targeted by state-sponsored actors, including a separate supply-chain compromise attributed to the Lotus Blossom group earlier in 2026, organizations should treat outdated builds of widely used utilities as active initial-access vectors.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
